Facebook Fighting Against Massively Broad Warrant From NY District Attorney For All Information From 381 Accounts

from the 4th-amendment? dept

Last week, after finally having a gag order lifted by a court, Facebook revealed how it had spent the last year fighting back against an incredibly broad search warrant from the Manhattan District Attorney's office, for basically all information -- including private messages -- from 381 user accounts. The warrant came complete with a gag order forbidding the company from telling anyone -- including the 381 people -- about the search. The searches were related to an investigation that resulted in charges being filed against over 100 former NYC police and firefighters for a giant disability fraud scheme. Basically, those retired officers faked disabilities, while their Facebook accounts supposedly revealed that their disability claims were bogus. While we're all for rooting out former government employees clearly abusing the system, we're even more worried about overly broad government intrusions like this.

Part of the issue, though, is over who has standing. As you may recall, Twitter was involved in a somewhat similar situation a few years back, when it went to court to protect the private messages of Malcolm Harris, who was involved in some Occupy Wall St. protests. In that case, Twitter told Harris, and Harris objected, but the court said it was only an issue between the government and Twitter, so Harris had no standing. Twitter then fought the issue, but eventually lost. The details in this case are a bit different (including the type of request -- a search warrant, rather than a 2703(d) order in Twitter's -- case, but the basic principles are fairly similar.

Orin S. Kerr, a law professor at George Washington University who is an expert on digital searches and seizures, said Facebook was trying to do something unusual in establishing a right for service providers to challenge a warrant. “The real question is, ‘Can they challenge warrants for their customers?’ And I think the answer is probably not, under current law,” Mr. Kerr said.

While some have made comparisons to last week's Supreme Court ruling on mobile phone searches, which recognized that the digital data you store on your phone and "in the cloud" are more like the personal effects you have in your house, it's unlikely that ruling will have much of an impact here. After all, the point of that case was to tell law enforcement to "get a warrant." And, in this case, that's exactly what the DA's office did.

The bigger question may be one of due process and standing in terms of challenging these warrants. As Facebook's deputy general counsel, Chris Sonderby, explains:

Of the 381 people whose accounts were the subject of these warrants, 62 were later charged in a disability fraud case. This means that no charges will be brought against more than 300 people whose data was sought by the government without prior notice to the people affected. The government also obtained gag orders that prohibited us from discussing this case and notifying any of the affected people until now.

We’ve gone to court and repeatedly asserted that these overly broad warrants–which contain no date restrictions and allow the government to keep the seized data indefinitely–violate the privacy rights of the people on Facebook and ignore Fourth Amendment safeguards against unreasonable searches and seizures. We fought forcefully against these 381 requests and were told by a lower court that as an online service provider we didn’t even have the legal standing to contest the warrants. We complied only after the appeals court denied our application to stay this ruling, and after the prosecutor filed a motion to find us in criminal contempt.

In talking to the NY Times, Sonderby elaborated that when the DA's office said that the individuals themselves would have standing to challenge the use of the collected evidence later, that left out all of the people whose information was taken, but who weren't charged. To them, they just had their private effects searched with no recourse.

“It appeared to us from the outset that there would be a large number of people who were never charged in this case,” he said. “The district attorney’s response was that those people would have their day in court. There are more than 300 people that will never have that chance.”

In some ways, this case is a bit trickier than others. When there's probable cause, allowing law enforcement to get a warrant and do a search, makes sense. The real problem here is the incredibly broad nature of the warrants in this case, and the fact that there's really no way to challenge that factor. Facebook has basically been told it can't challenge it. The 300 people who aren't charged have no way of challenging it. And those that were charged really can only challenge the situation involving their personal circumstances, rather than the overly broad nature of the original warrant.

It seems worth pointing out, by the way, that the warrant happened last July, about a month after the first Snowden revelations. While Facebook notes that it was the massive size of the warrant (more than 10x larger than any previous one) that made the company challenge it, it seems quite likely that the sudden attention on internet companies and their willingness to share personal information with the government played a big role in the decision as well. Chalk another one up to the Snowden Effect.

Isn't there a middle ground?

I can only presume that the reason for the gag order is to keep the people being investigated from deleting their information from Facebook. Couldn't the process just direct Facebook to make a copy of the relevant data so deletion would not be an issue? Once that is done (and note the data would be held by Facebook) the individuals could be notified and have recourse to fighting the subpoena. When that fight is done, the data can either be released to the AG or allowed to evaporate from wherever Facebook was holding it.

I fail to see how the warrants covering 300 Facebook subscribers aren't general warrants. Was there 300 probable cause reasons listed for each and every individual in the warrants?

The article also states there was no "particular things or effects" listed anywhere in the warrant. Isn't a search warrant supposed probable cause, along with the particular person, place, and things to be searched and seized?

The icing on the general warrant cake is the NY District Attorney did all of this in complete secrecy. The only way to know about the secret warrant is when charges are brought against you through indictment.

Once indicted, the only way to challenge the overly broad secret general warrant is to request the warrant be quashed, and the evidence suppressed. Due to the warrant showing no probable cause and covering an unlimited scope of what is to be searched and seized.

Re: Isn't there a middle ground?

That sorta solves the notification part, but the result would have been turning it all over, and that leaves the 300 peoples information who were not charged in the hands of the authorities. The system keeps a record for lots of things it probably really shouldn't, like arrests that are not prosecuted (along with all the attendant booking photos, fingerprints, inclusion in a variety of databases, etc.). These and other collections of data on citizens is just a continuation of the Executives' collect it all policy cause we are all terrorists.

Of course, the Manhattan DA could have just asked the NSA for the data. I had the following email exchange with a network engineer friend the other day.

Re: Isn't there a middle ground?

If the user deleted the data after being made aware that it was part of an investigation, then it would be pretty easy to get a destruction of evidence charge added and would all but guarantee a win for the prosecution.

Only 3 lettered government agencies can delete/lose/mishandle evidence and not suffer consequences.

No rights here, only privileges

So the one who knows about the warrant can fight it but doesn't have standing, making their fighting back pretty much useless. Meanwhile the ones who are having their data scooped up only learn about it after it's already happened.

Yet another court tossing out those pesky 'Constitutional rights', as if you can only object to them being violated after the fact, then they're not doing you much good now are they?

As for the idea that those who weren't charged can argue their case in court(again, after the fact)? You don't have to be a seer to see where that one would go. They'd argue that their privacy rights have been violated, the state will argue that they can't prove they've suffered any damages because of their actions, and the court will rule on the side of the state. Case closed, and another bullet added to the corpse of Constitutional rights.

Re: It seems they want it both ways

Either that or a condition of government employment is having your common sense either surgically removed or somehow completely neutralized. Of course, to my way of thinking, a desire to enter government service in the first place is indicative of a (perhaps profound) lack of common sense.

Re: Re: It seems they want it both ways

Common sense isn't the problem, the thing they make sure to avoid, either screening out or eradicating with on the job training is any sense of ethics.

If someone is the kind of person willing to ask themselves 'Am I about to royally screw someone over, or violate their rights on a massive scale, just because I think it'll help me and/or my job?' before they do it? Or are likely to answer that question with something other than 'Who cares, it's for the greater good'? That is not the kind of person the government wants to employ.

Smart but clueless/naive, ethically challenged, and obedient, those are the three qualities they look for in an employee.

are you kiddin' me? name a single subject where the USA law is NOT completely 'a bit of a mess'!!if ever there was an understatement, this must be in the running!

'The real problem here is the incredibly broad nature of the warrants in this case, and the fact that there's really no way to challenge that factor'

surely the way to challenge it was for the warrant to have been denied until it was more specific, tied down to those who were REALLY suspected of wrong-doing and ordering all other information concerning those not suspected of wrong doing to be destroyed, with no copies of any kind kept, if indeed their information was wanted to begin with?

Re: Re: It seems they want it both ways

Remember, many people seek positions of power so that they will not have to obey the law or suffer any consequences for their law breaking. The more power they get, the less relevant the laws of the land.

Re:

'The real problem here is the incredibly broad nature of the warrants in this case, and the fact that there's really no way to challenge that factor'

surely the way to challenge it was for the warrant to have been denied until it was more specific, tied down to those who were REALLY suspected of wrong-doing

Yes, the judge(s) who approved that warrant and sustained the state's defenses of it are also in the wrong for approving such a broad warrant. However, the author's point was that, whether or not the original judge shows the common sense not to issue a general warrant, there should be a way for the parties affected to challenge the warrant, whether because it is overbroad, based on inaccurate information, or any of the other causes that normally result in a legal order being overturned. In this scenario, despite the efforts of Facebook's attorneys, the warrant was not overturned on any of these grounds.

Re: Re: Probably cause?

I say, regardless of the outcome of this case, if every time law enforcement try to use a warrant like this it gets hung up in court for a year, that's a good incentive for them to write narrower warrants.

And this is why I don't have a Facebook account. That and atrocious default privacy settings along with a real name policy that exposes users to doxing while doing nothing about griefers who vandalise other people's memorial walls.

Re:

In fairness, the real name policy is a joke (as all such policies are unless you are required to submit authenticated ID to open an account). Most of the people I know who have Facebook accounts don't use their real names on them, but they use names that sound real. What Facebook actually has is a "plausible name" policy.

And here I thought it was perfectly clear that if someone doesn't have standing to challenge a warrant then neither do they have standing to respond to it. How can you respond to a warrant when you don't have standing to challenge it?

I would believe that I could not fulfill the requirements of the warrant without standing, then be held in contempt for "refusing" to comply. Damned if you do and damned if you don't, but at least corporations like Facebook can't be sent to prison.

Re: Re:

That's what I believe too, but I also understand that Facebook tries with all its feeble might to make that as hard as possible. That's why if I was to ever create an account on that site (will never happen, like), I'd make sure to create an email account in a plausible name for Facebooks bots to look at. Simples!